Update a monitored user

PUT /api/entity_analytics/monitoring/users/{id}

Api key auth Basic auth

Spaces method and path for this operation:

put /s/{space_id}/api/entity_analytics/monitoring/users/{id}

Refer to Spaces for more information.

Updates the details of an existing monitored privileged user by their document ID.

Path parameters

id string Required

The document ID of the monitored user to update

application/json

Body Required

entity_analytics_monitoring object
Hide entity_analytics_monitoring attribute Show entity_analytics_monitoring attribute object
- labels array[object]
  Hide labels attributes Show labels attributes object
  
  field string Required
  
  Maximum length is 256.
  
  source string Required
  
  value string Required
  
  Maximum length is 256.
id string

Maximum length is 256.
labels object
Hide labels attributes Show labels attributes object
- source_ids array[string]
  
  Not more than 100 elements. Maximum length of each is 256.
- source_integrations array[string]
  
  Not more than 100 elements. Maximum length of each is 256.
- sources array
  
  Not more than 100 elements. Values are csv, index_sync, or api.
user object
Hide user attributes Show user attributes object
- is_privileged boolean
  
  Indicates if the user is privileged.
- name string
  
  Maximum length is 512.

Responses

200 application/json

User updated successfully
Hide response attributes Show response attributes object
- entity_analytics_monitoring object
  
  Hide entity_analytics_monitoring attribute Show entity_analytics_monitoring attribute object
  
  labels array[object]
  
  Hide labels attributes Show labels attributes object
  
  field string Required
  
  Maximum length is 256.
  
  source string Required
  
  value string Required
  
  Maximum length is 256.
- id string
  
  Maximum length is 256.
- labels object
  
  Hide labels attributes Show labels attributes object
  
  source_ids array[string]
  
  Not more than 100 elements. Maximum length of each is 256.
  
  source_integrations array[string]
  
  Not more than 100 elements. Maximum length of each is 256.
  
  sources array
  
  Not more than 100 elements. Values are csv, index_sync, or api.
- user object
  
  Hide user attributes Show user attributes object
  
  is_privileged boolean
  
  Indicates if the user is privileged.
  
  name string
  
  Maximum length is 512.
  
  entity object
  
  Hide entity attribute Show entity attribute object
  
  attributes object
  
  Hide attributes attribute Show attributes attribute object
  
  Privileged boolean
  
  Indicates if the user is privileged.
- @timestamp string(date-time)
- event object
  
  Hide event attributes Show event attributes object
  
  @timestamp string(date-time)
  
  ingested string(date-time)

PUT /api/entity_analytics/monitoring/users/{id}

curl \
 --request PUT 'https://localhost:5601/api/entity_analytics/monitoring/users/{id}' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"entity_analytics_monitoring\": {\n    \"labels\": [\n      {\n        \"field\": \"department\",\n        \"source\": \"api\",\n        \"value\": \"Security\"\n      }\n    ]\n  },\n  \"user\": {\n    \"is_privileged\": true,\n    \"name\": \"john.doe\"\n  }\n}"'

Request example

{
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}

Response examples (200)

{
  "@timestamp": "2026-01-28T12:00:00.000Z",
  "entity_analytics_monitoring": {
    "labels": [
      {
        "field": "department",
        "source": "api",
        "value": "Security"
      }
    ]
  },
  "event": {
    "ingested": "2026-01-28T12:00:00.000Z"
  },
  "id": "user-abc-123",
  "user": {
    "is_privileged": true,
    "name": "john.doe"
  }
}